Cybersecurity threats do not always enter an organization through its own systems. Increasingly, attackers exploit trusted external partners, from accounting firms and IT service providers to software vendors and other third parties with access to sensitive data or business-critical systems.
For attackers, compromising one supplier can be far more efficient than targeting dozens of organizations individually. A single set of stolen credentials may provide access to multiple customers, turning a trusted business relationship into a potential entry point for a much wider attack.
According to the 2026 Verizon Data Breach Investigations Report (DBIR), third parties were involved in 48% of analyzed data breaches, representing a 60% increase in one year. The trend highlights a growing challenge for organizations: cybersecurity can no longer be managed solely within the boundaries of their own IT environments.
Ivan Vedak, Information Security Manager at ASEE, emphasizes that the issue often comes down to something organizations struggle to answer with confidence: who has access to their systems, why they have it, and whether that access is still necessary.
Third-party risk extends well beyond companies that directly store customer data. IT service providers, cloud platforms, software vendors and other business partners may have access to corporate systems, source code, administrative accounts or sensitive information.
A smaller supplier with weaker security controls can become an easier target than a large organization with more mature defenses. Once compromised, that supplier's legitimate access can provide attackers with a pathway into multiple customer environments.
Vedak points to another important finding: research by ISACA involving approximately 1,300 professionals found that one-quarter of organizations had experienced a supply chain attack within a year. Respondents identified external service providers with access to systems, data and code as a major source of risk. Only 44% expressed high confidence in the access controls across their supply chains.
For Vedak, the practical implications are particularly telling.
“When I sit down with an organization and ask how many external users have active access to its systems, there is often no clear answer. Someone has to search through spreadsheets or rely on memory.”
That lack of visibility creates an opportunity for attackers. Compromising a single accounting firm or IT partner that serves dozens of businesses may be easier than attacking every customer individually.
The problem becomes more serious when external access is protected by weak authentication, grants broader permissions than the work requires, or relies on shared accounts that make it difficult to establish who performed a particular action.
Supplier accounts are particularly attractive targets when access remains active for long periods, permissions are extensive, and activity is poorly monitored. Because attackers may use legitimate credentials, their activity can be harder to distinguish from normal business operations.
The first step is to treat supplier access with the same level of scrutiny as privileged access within the organization itself.
According to Vedak, businesses need a complete inventory of external partners with access to their systems. That inventory should also classify suppliers according to risk. A provider maintaining a public website does not present the same level of exposure as an IT administrator with access to systems containing personal or financial data.
Once the organization understands who has access, it can apply controls proportionate to the risk.
Key measures include:
One often-overlooked issue is employee turnover at the supplier itself. When a supplier's employee changes roles or leaves the company, the customer may never be informed. Their account can remain active long after the original business need has disappeared.
These measures help organizations move from assuming that trusted partners are secure to actively controlling the access they provide.
Technical controls are essential, but they cannot replace clear contractual obligations and accountability.
Vedak recommends defining security requirements in supplier agreements, including incident notification deadlines measured in hours, the right to review or audit relevant controls, approval requirements for subcontractors, and a clear exit strategy.
Contracts should also establish how suppliers protect data, manage their own service providers, address security vulnerabilities, and handle access and information when a business relationship ends.
These requirements are increasingly relevant in regulated environments. The NIS2 Directive establishes cybersecurity risk-management obligations for organizations within their scope, including supply chain security. In the financial sector, the Digital Operational Resilience Act (DORA) introduces specific requirements for managing risks associated with ICT third-party providers.
The precise obligations depend on the applicable framework and the organization's role, but the underlying principle is consistent: outsourcing a service does not eliminate the need to manage its security risks.
Supplier assessments should reflect the potential impact of a compromise. A structured security questionnaire, evidence of implemented controls or a relevant certification, such as ISO/IEC 27001, may be appropriate for some suppliers. More critical relationships may warrant deeper assessments and periodic audits.
The goal is not to eliminate external access. Many organizations depend on suppliers to operate efficiently. Instead, they need to ensure that compromising one partner does not automatically expose the entire business.
Documented controls and contractual commitments are important, but they cannot demonstrate on their own how effectively two organizations will respond to an actual incident.
Vedak identifies collaboration between customers and suppliers as one of the most underestimated aspects of supply chain security. A supplier questionnaire completed once a year may provide useful information, but it will not necessarily help when an attacker misuses an administrator account late on a Thursday evening.
Organizations should establish direct working relationships between the people responsible for security on both sides before an incident occurs.
Vedak highlights four practical priorities:
Both parties should know whom to contact, how an incident must be reported, and who is authorized to make decisions. A joint exercise can reveal gaps that are difficult to identify through documentation alone, such as uncertainty over who can disable a supplier's access.
Organizations should agree on which party maintains the relevant logs, who can access them, and how long they are retained. Without that agreement, collecting the evidence needed to investigate an incident can become unnecessarily difficult.
Regular discussions between technical teams help organizations identify changes in access requirements, address emerging vulnerabilities, and resolve security issues before they become incidents.
Where appropriate, joint testing can help verify that security controls work as expected and that both parties understand their responsibilities.
Experts also emphasize the value of walking through an incident scenario step by step. Even a short annual exercise can expose outdated contact lists, unclear decision-making responsibilities, or uncertainty about who has the authority to suspend a supplier's access.
Continuous monitoring is equally important. An external administrator logging in outside agreed working hours or downloading an unusual volume of files may indicate suspicious activity. Detecting such behavior is only useful, however, when the organization has a defined process for investigating alerts and responding promptly.
Effective supply chain security is not a one-time assessment. It requires visibility into external access, controls proportionate to risk, clear contractual expectations, and ongoing cooperation between organizations.
Businesses should know which suppliers can reach their systems, what those suppliers can do, and how quickly access can be restricted if something goes wrong. They should also ensure that incident response procedures are understood and tested by everyone involved.
As Vedak's recommendations illustrate, strong security depends on more than technology or compliance documentation. It also depends on whether organizations and their suppliers have established clear responsibilities and can work together under pressure.
A trusted supplier should never become an unchecked route into your business. The objective is to build relationships that enable collaboration while ensuring that access remains visible, limited, monitored, and accountable.
Managing supplier access doesn't have to mean choosing between security and business efficiency. With the right identity and access management controls, organizations can give external partners the access they need while keeping permissions limited, authentication secure, and activity traceable.
ASEE AuthHub brings identity management, Single Sign-On (SSO), and Multi-Factor Authentication (MFA) together in one platform. With centralized access policies, role-based permissions, adaptive authentication, and audit logging, AuthHub helps organizations strengthen access control across connected applications and reduce the risks associated with compromised accounts.
This article is adapted from the original published on lidermedia.hr.
